Tag: ngtcp2

ngtcp2 1.26.0 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

Major changes:

• doc: Add pseudo code and documentation for writing packets with GSO
• build(deps): bump actions/stale from 10 to 11
• Cleanup
• No stream is closed just because STOP_SENDING is received
• Restructure conn
• Tighten long header packet length check for 32-bit platform
• map: Remove key if resizing table fails
• examples/server: Check QUIC version
• Add callback for extendmaxdata
• Update callback tests
• Do not retire the fallback DCID if it is still used
• Fix CUBIC CWND increment function
• Call extend_max_data on handshake completion
• Return STREAM_LIMIT error if the limit is violated by STREAMS_BLOCKED
• Add ngtcp2_conn_tx_strmq_push_if_not
• Send STREAM_DATA_BLOCKED/DATA_BLOCKED when data is actually blocked
• Update doc
• Simplify ngtcp2_conn_write_stream
• Rework the incoming NEW_CONNECTION_ID validation
• Assert that ngtcp2_conn_tls_early_data_rejected only called from client
• Return NGTCP2_ERR_STREAM_STATE for RESET_STREAM against local uni stream
• Remove the code that handles the case that is too large for UDP datagram
• Rename offset in ngtcp2_data_blocked and ngtcp2_stream_data_blocked
• Add transport parameters decode tests
• Add more transport parameter decoding tests
• Add wf test
• Add test for resending NEW_TOKEN
• Rtb test
• Simplify conn test
• GHA: Bump Ubuntu to 26.04
• Examples rewrite tests with new munit cxx assertions
• Bump clang-format to 21
• GHA: Bump clang to 21
• Use packaged ossl
• GHA: Reduce openssl1/3 jobs
• GHA: Reduce cmake jobs
• GHA: Fix quic interop runner
• Tweak the maximum value of ngtcp2_ratelim.burst
• Fix slow start pacing gain
• Reset max UDP payload size when the peer’s IP address changes
• Check picotls encryption level
• Check ossl encryption level
• Server should send CONNECTION_CLOSE in earlier level
• GHA: Use libressl for macos build
• Add oss-scanner files
• examples/client: Fix div by zero
• examples/server: Do not truncate file sizes on 32-bit targets
• Limit token length
• Add 0 length STREAM frame filter to rtb_reclaim_on_retry
• Fix max decryptable pkt num marker before first decryption
• Penalize the short stream data write
• Optimize ngtcp2_rtb_reclaim_on_pto
• ngtcp2_conn_write_aggregate_pkt2: Check path to end aggregation
• Bump libressl to v4.4.0
• send_quantum should be at least single MTU
• Use validated_path before it is gone
• Graceful connection closure when 1 RTT key is installed more than once
• Process 0RTT packet only after 0RTT and 1RTT keys are available
• Limit client’s PATH_RESPONSE to the unvalidated path
• Explicitly verify path validation timeout
• Make PATH_RESPONSE PTO eliciting
• Reclaim connection level flow control window in stream close for RESET_STREAM
• Refine ngtcp2_rob fragmentation threshold detection
• Deal with the early HANDSHAKE_DONE from server
• Improve map hasher
• Rearm loss timer after it is cancelled by anti-amplification limit
• Properly handle the case when client migrates back to the original path
• Do not start pv round if no PATH_CHALLENGE is sent
• Make ngtcp2_pkt_decode_version_cid return error on zero input
• Keep congestion state if nothing has been delivered
• Deal with TLS stack that does not bail out without transport params
• Fix packet number decoding
• Deal with the connection ID limit error
• Reject ACK that acknowledges packet that is sent later
• Remove rejection from handshake address because it is unreliable
• Reset ppe pending state without WRITE_MORE flag set
• Deal with stream shutdown in stop_sending callback
• Revert “Stop buffering data after shutting downstream read”
• Prevent a used DCID from being retired
• Avoid abandoned DCID stranded
• Return error when ngtcp2_conn_initiate_key_update called during handshake
• Avoid DCID reuse
• Derive initial key before version is negotiated
• Prevent a used DCID from being retired in the another way
• Do not call dcid_status callback until handshake completes
• Revert “Make sure that NGTCP2_CONN_FLAG_PPE_PENDING is not leaked”
• Do not block PATH_RESPONSE due to lack of DCID and credit
• Reset CUBIC undo variables once a loss is confirmed
• Fix conn_shutdown_stream_read
• Tweak key update confirmation
• Fix memory leak
• Count decryption failures for Handshake and 0RTT keys
• examples/server Fix handler leak
• Install preferred address before reading server 0.5RTT packets
• Ensure at least 1 byte frame is allocated on encoding
• Count empty STREAM frame toward glitch counter
• Do not clear PTO eliciting flag
• Fix bug that lost_datagram is not called
• crypto/ossl: Guard tx_level from 0RTT as well
• hqclient: Remove streams on close
• Fix 0RTT key not discarded with callback
• Send the control frames in 0RTT
• Revert “Count empty STREAM frame toward glitch counter”
• Fix invalid qlog with PADDING only packet
• Deal with out of memory after getting Connection ID
• Remove problematic glitch counter for some frames
• Write stream data thresh
• Fix ngtcp2_vec_merge
• Stop the path validation upfront
• Simplify map insert
• Bump tls deps
• Fix heap overruns when malloc is only 4-byte aligned (like on ESP32)
• examples: Deal with if_indextoname failure
• GHA: Remove macos-15

The ngtcp2 library stack is built against OpenSSL 4.0.3, and the QUIC client is named osslclient.

ngtcp2 1.25.0 rpms released and added to all supported platforms.

Major changes:

– Fix build error with gcc-16 by @tatsuhiro-t – build(deps): bump actions/cache from 5 to 6 by @dependabotbot – ksl: Align keys in 8 bytes boundary by @tatsuhiro-t – bbr: Update longterm variable computation by @tatsuhiro-t – Remove condition that is always true by @tatsuhiro-t – Verify the end offset of STREAM frame before updating flow control by @tatsuhiro-t – Rework connection flow window accounting after sending STOP_SENDING by @tatsuhiro-t – Stop buffering data after shutting downstream read by @tatsuhiro-t in – Cleanup by @tatsuhiro-t – Update bbr by @tatsuhiro-t – Update doc by @tatsuhiro-t – Add ngtcp2_stream_close2 callback by @tatsuhiro-t – examples: Adopt ngtcp2_stream_close2 callback by @tatsuhiro-t – Tweak stream_close2 callback behavior by @tatsuhiro-t – Expand NGTCP2_MAX_INITIAL_CRYPTO_OFFSET to 64K by @tatsuhiro-t – Partially revert #2242 by @tatsuhiro-t – Make max CRYPTO offsets configurable by @tatsuhiro-t – Minor cleanup by @tatsuhiro-t – Optimize rob by @tatsuhiro-t – build(deps): bump actions/setup-python from 6 to 7 by @dependabotbot – Optimize acktr by @tatsuhiro-t – Remove ngtcp2_acktr_entry and squeeze len into key by @tatsuhiro-t – Minor fixups by @tatsuhiro-t – Amend ba2e5f0142863a0a539671e0194de6019008ad3e (part of #2255) by @tatsuhiro-t – Deal with the case where client migrate back to the original path by @tatsuhiro-t – crypto/quictls: Rework the global initialization by @tatsuhiro-t – ksl: Remove unnecessary NULL initialization by @tatsuhiro-t – Document about C11 compilers by @tatsuhiro-t – Bump boringssl by @tatsuhiro-t – Bump aws-lc to v5.4.0 by @tatsuhiro-t – Bump picotls by @tatsuhiro-t – fuzz: Fuzz more parameters like CID, AEAD tag, and transport parameters by @tatsuhiro-t – Revert “Make max CRYPTO offsets configurable” by @tatsuhiro-t – Require nghttp3 >= 1.18.0 by @tatsuhiro-t

ngtcp2 libraries stack built with OpenSSL 4.0.1. QUIC client name is osslclient.

ngtcp2 1.24.0 rpms released and added to all supported platforms.

Major changes:

– crypto: Add openssl libs to cryptotest by @tatsuhiro-t – Add –disable-crypto configure option by @tatsuhiro-t – crypto: Add ngtcp2_crypto_ossl_free by @tatsuhiro-t – examples: Avoid the deprecated nghttp3 APIs by @tatsuhiro-t – lib: Add recv_stop_sending callback by @pimterry – lib: Add ngtcp2_conn_set_max_stream_data_thresh by @tatsuhiro-t – lib: Tweak ngtcp2_conn_set_max_stream_data_thresh by @tatsuhiro-t – Remove max stream data thresh by @tatsuhiro-t – Rewrite window filter from scratch by @tatsuhiro-t – lib: Tweak app-limited detection by @tatsuhiro-t – build(deps): bump actions/checkout from 6 to 7 by @dependabotbot – lib: Simplify app-limited conditions by @tatsuhiro-t – Bump openssl to v4.0.1 by @tatsuhiro-t – Bump boringssl by @tatsuhiro-t – Bump aws-lc to v5.1.0 by @tatsuhiro-t – Bump picotls by @tatsuhiro-t – Bump wolfssl to v5.9.2-stable by @tatsuhiro-t

ngtcp2 libraries stack built with OpenSSL 4.0.1. QUIC client name is osslclient.

ngtcp2 1.23.0 rpms released and added to all supported platforms.

Major changes:

– examples: Use std::print for sim by @tatsuhiro-t
– examples: Rewrite util::split_str by @tatsuhiro-t
– examples: Refine formatter by @tatsuhiro-t in
– log: Faster logging by @tatsuhiro-t in
– examples: Introduce ProtoCodec to deduplicate examples by @tatsuhiro-t in
– Use ULL consistently by @tatsuhiro-t in
– examples: Stop surrounding constexpr variables with anonymous namespace by @tatsuhiro-t in
– examples: Use UZ for size_t by @tatsuhiro-t in
– examples: Use static constexpr for somewhat large structs by @tatsuhiro-t in
– examples: Use try_emplace for safe insertion of move only object by @tatsuhiro-t in
– Transit to closing state when sending application close by @tatsuhiro-t in
– Specify QualifierOrder by @tatsuhiro-t in
– examples: Prefer operator== to strcmp by @tatsuhiro-t in
– examples: Use std::filesystem::path for file path by @tatsuhiro-t in
– Provide generic ngtcp2_max and ngtcp2_min by @tatsuhiro-t in
– Examples fixup by @tatsuhiro-t in
– Rewrite fallback ntoh/hton functions for win32 by @tatsuhiro-t in
– Add ngtcp2_secure_clear by @tatsuhiro-t in
– Clear sensitive secrets and keys after use by @tatsuhiro-t in
– Add const version by @tatsuhiro-t in
– Fix grammatical errors by @tatsuhiro-t in
– crypto: Add tests for token validation by @tatsuhiro-t in
– examples: Add inline to NGTCP2_SERVER by @tatsuhiro-t in
– Add const and remove duplicated code by @tatsuhiro-t in
– Remove stale function declarations by @tatsuhiro-t in
– crypto: Deal with overflow when computing token timeout by @tatsuhiro-t in
– build(deps): bump actions/github-script from 8 to 9 by @dependabotbot in
– examples: Read ECH configuration PEM in the correct format by @tatsuhiro-t in
– Revert “fix: prevent max_idle_timeout multiplication overflow in transport params decode” by @tatsuhiro-t in
– Deal with large max_idle_timeout that could overflow in computation by @tatsuhiro-t in
– Fix qlog params set stack overflow by @tatsuhiro-t in
– Log enhancement by @tatsuhiro-t in
– Bump LibreSSL to v4.3.1 by @nak3 in
– examples: Enable X25519MLKEM768 for LibreSSL by @nak3 in
– pq: Adopt designated initializers by @tatsuhiro-t in
– examples: Fix parse_uint_internal by @tatsuhiro-t in
– examples: Send stateless reset if token is required and unreadable by @tatsuhiro-t in
– examples: Remove unneeded iostream include by @tatsuhiro-t in
– Add missing initialization for fields that are not used for CRYPTO by @tatsuhiro-t in
– rst: Rename TCP centric variable names by @tatsuhiro-t in
– bbr: Cap maximum drain rounds by @tatsuhiro-t in
– GHA: Avoid azure Ubuntu mirror by @tatsuhiro-t in
– Bump openssl to v4.0.0 by @tatsuhiro-t in
– Bump boringssl by @tatsuhiro-t in
– Bump picotls by @tatsuhiro-t in
– Bump wolfssl to v5.9.1-stable by @tatsuhiro-t in
– examples/sim: Deal with retry due to Initial packet loss by @tatsuhiro-t in
– examples/sim: Minor improvements by @tatsuhiro-t in
– Bump aws-lc to v1.73.0 by @tatsuhiro-t in
– Bump wolfssl to v5.9.1-stable in interop Dockerfile by @tatsuhiro-t in
– lib: Apply absolute upper bound against CRYPTO data offset by @tatsuhiro-t in
– Adopt sphinx version-add and version-deprecated directives by @tatsuhiro-t in
– ppe: Robust ngtcp2_ppe_padding_size by @tatsuhiro-t in
– ppe: Ensure packet protection sample with ngtcp2_ppe_dgram_padding_size by @tatsuhiro-t in
– cubic: Add missing is_cwnd_limited reset after exiting slow start by @tatsuhiro-t in
– Make bitwise operations robust by @tatsuhiro-t in
– Make all private hex constants unsigned by @tatsuhiro-t in
– lib: Ensure that unidirectional stream shutdown flags properly set by @tatsuhiro-t in
– More unsigned hex integer literals by @tatsuhiro-t in
– Fix strict aliasing issue in ngtcp2_get_varint by @tatsuhiro-t in
– Net cleanup by @tatsuhiro-t in
– Bump libressl to v4.3.2 by @tatsuhiro-t in
– Consider static const if possible by @tatsuhiro-t in
– @Alex-Tsvetanov made their first contribution

ngtcp2 1.22.1 rpms released and added to all supported platforms.

Fixed vulnerabilities:

– CVE-2026-40170

ngtcp2 libraries stack built with OpenSSL 4.0.0. QUIC client name is osslclient.

ngtcp2 1.22.0 rpms released and added to all supported platforms.

As soon as ngtcp2 now requires C++23 compiler, we moved to build it with GCC 15.2.0. CentOS 7 build now requires GCC 15 runtime, as soon as we build all CentOS 7 toolset ourselves.

ngtcp2 libraries stack built with OpenSSL 3.5.5. quic client name is osslclient.

ngtcp2 1.21.0 rpms released and added to all supported platforms.

ngtcp2 libraries stack built with OpenSSL 3.5.5. quic client name is osslclient.